Skip to content
This repository was archived by the owner on Dec 13, 2019. It is now read-only.

[wallet-ui] Login fail should happen before signature sent #1317

Open
ldct opened this issue Apr 17, 2019 · 2 comments
Open

[wallet-ui] Login fail should happen before signature sent #1317

ldct opened this issue Apr 17, 2019 · 2 comments
Assignees
Labels
🐞 Bug 🛡️ Security 📦 Wallet UI code related to packages/wallet-ui
Milestone

Comments

@ldct
Copy link
Member

ldct commented Apr 17, 2019

No description provided.

@ldct ldct changed the title Login fail should happen before signature sent [playground] Login fail should happen before signature sent Apr 17, 2019
@snario snario closed this as completed May 8, 2019
@ldct ldct reopened this May 8, 2019
@snario
Copy link
Contributor

snario commented May 8, 2019

@ebryn this is an important security thing. We should check if there is a user first before signing a message and sending it to the server.

@joelalejandro
Copy link
Contributor

@snario I think the Wallet UI has dragged the same unsafe implementation.

If I understand correctly, the protocol would be:

  1. See if there is a user with the Metamask's ethAddress registered.
  2. If the user exists on the database, request the signature. If not, return an error and not request the signature.
  3. If the signature is valid, allow the user to login.

@joelalejandro joelalejandro self-assigned this Aug 15, 2019
@joelalejandro joelalejandro added 🐞 Bug 📦 Wallet UI code related to packages/wallet-ui 🛡️ Security labels Aug 15, 2019
@joelalejandro joelalejandro added this to the 👽 Grunty milestone Aug 15, 2019
@joelalejandro joelalejandro changed the title [playground] Login fail should happen before signature sent [wallet-ui] Login fail should happen before signature sent Aug 15, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
🐞 Bug 🛡️ Security 📦 Wallet UI code related to packages/wallet-ui
Projects
None yet
Development

No branches or pull requests

3 participants